Truly multi-authority ‘Prêt-à-Voter’

In-polling-booth electronic voting schemes are being implemented in government binding elections to enable fast tallying with endto- end verification of the election result. One of the most significant issues with these schemes is how to print or display the ballot without jeopardising privacy. In several of these schemes, freshly generated unmarked ballots contain critical information which combined with public “bulletin board” information breaks ballot secrecy. We present a practical solution which uses re-encryption inside the polling booth to print ballot papers in a privacy-preserving manner. This makes practical, at a user rather than computer level, multi-authority voting. We apply this solution to Prêt-à Voter, a state-of-the-art electronic voting system trialled in a recent Victorian state election.We propose two approaches: one with higher security and another with stricter usability constraints. The primary benefit is that ballot papers no longer pose a privacy risk. The solution has the major benefit of resolving the conflict between auditability and forward secrecy of printers, a problem left open by the most recent work in this area. Additional benefits include practical privacy from compromised polling-place devices, while preserving receipt-freeness against a more general adversary. Although we do not provide privacy against a wholly compromised authority, a voter needs honesty from only one of the machines at the polling site for secrecy.